I'd like to deploy a Canvas Connected App as part of a managed package and be able to dynamically assign users access to it via a Permission Set.
The Canvas App is using the Signed Request (Post) access method.
Under Manage Apps > Connected Apps > OAuth policies the Permitted Users have been set to "Admin approved users are pre-authorized". On the same screen a Permission Set has been added to the Connected App.
When the Permission Set and Canvas App are deployed as part of a managed package the Permitted Users resets to "All users may self-authorize" in the installing org.
After manually changing Permitted Users to "Admin approved users are pre-authorized" in the target org and attempting to add the managed permission set back to the Connected App I get the error:
Cannot Modify Managed Component
The component you are attempting to modify is part of a managed package, and cannot be modified. For more information, see Insufficient Privileges Errors.
Is this an explicit security restriction to ensure managed packages don't automatically grant users access?
I.e. Only an Admin in the local org can grant access to the App.
Based on App disappears from Permission Set included with package it appears to be a limitation of the packaging process rather than a specific security control.
You can include permission sets as components in a package, with the following permissions and access settings:
- Custom object permissions
- External data source access
Assigned apps and tab settings are not included in permission set components.
So the assigned apps aren't carried over on the permission set currently.
The idea Maintain App and Tab settings for Permission Sets in Managed Packages would be worth promoting.
That leaves the question - How can a managed package control user access to the deployed Connected App?
Maybe if the installing Admin creates a new Permission Set and configures it against the Connected app as a manual post install step. Then the Id of the Permission Set that grants access could be configured into the managed package for creating the PermissionSetAssignment records.